AI-102 Question 77
Select 3You are designing a solution for an Azure-based application that uses sensitive account keys to access a storage account. To enhance security, you decide to use Azure Key Vault to protect these keys. Which of the following steps should you take to securely integrate your application with Azure Key Vault?
- A
Generate account keys directly within Azure Key Vault using the Key Vault API.
- B
Store the storage account keys as secrets in Azure Key Vault.
- C
Configure an Azure-managed identity for your application and grant it access to Azure Key Vault.
- D
Hard-code the Key Vault access credentials in your application code.
- E
Use Azure Key Vault's access policies to define which application has permissions to retrieve secrets.
Show answer and explanation
Correct answers: B, C, E
Explanation
To securely integrate with Azure Key Vault, you should store your sensitive account keys as secrets, configure an Azure-managed identity for secure authentication, and use access policies to control access. These steps ensure the keys are protected and only accessible by authorized applications or users.
- A. Incorrect.
Azure Key Vault does not generate storage account keys directly. Instead, it is used to store and manage sensitive keys and secrets.
- B. Correct.
Storing the storage account keys as secrets in Azure Key Vault ensures they are securely managed and accessed.
- C. Correct.
Using an Azure-managed identity allows your application to securely authenticate with Azure Key Vault without the need to hard-code credentials.
- D. Incorrect.
Hard-coding access credentials in application code is insecure and violates best practices for managing sensitive data.
- E. Correct.
Azure Key Vault access policies allow you to define specific permissions for applications and users, ensuring only authorized entities can retrieve secrets.